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JAPANESE INDUSTRIAL STANDARD JIS B 9704-1 : 2000 

(lEC 61496-1 : 1997) 

Safety of machinery— Electro^sensitive 

protective equipment — 
Part 1 I General requirements and tests 



Introduction This Japanese Industrial Standard has been prepared based on the 
first edition of lEC 61496-1 Safety of machinery — Electro-sensitive protective equip- 
ment—Part 1 : General requirements and tests published in 1997 with some modifi- 
cations of the technical contents. Portions underlined with dots are the matters modified 
from the original International Standard. A list of modifications with the explana- 
tions is given in annex 1, Provision of 4,2*3,1 defines the specifications of the rel- 
evant JIS, as well as the specifications of the original International Standard. 

A part of foreword of the original International Standard is included in introduc- 
tion of this part of JIS B 9704, and annex C (information), which does not consti- 
tute the provisions, is excluded. 

An electro-sensitive protective equipment (ESPE) is applied to machinery presenting 
a risk of personal injury. It provides protection by causing the machine to revert to 
a safe condition before a person can be placed in a hazardous situation. 

This part of JIS B 9704 provides general design and performance requirements 
of ESPEs for use over a broad range of appliances. Essential features of equipment 
meeting the requirements of this Standard are the appropriate level of safety-related 
performance provided and the built-in periodic functional checks/self-checks that are 
specified to ensure that this level of performance is maintained. 

This Standard has been developed to meet the needs of manufacturers, indus- 
trial users and safety enforcement authorities. This Standard has the status of a 
type B standard (group safety standard) and may be used as a normative reference 
in a dedicated product standard for the safety of machinery. 

Annexes A and B form an integral part of this Standard- Each type of machine 
presents its own particular hazards and it is not the purpose of this Standard to 
recommend the manner of application of the ESPE to any particular machine. The 
application of the ESPE should be a matter for agreement between the equipment 
supplier, the machine user and the enforcing authority, and in this context atten- 
tion is drawn to the relevant guidance established internationally, for example TR 
B 0008 (ISO/TR 12100-1) and TR B 0009 (ISO/TR 12100-2). 

1 Scope This part of JIS B 9704 specifies general requirements for the design, 
construction and testing of electro-sensitive protective equipment (ESPE) for the 
safeguarding of machinery. Special attention is directed to functional and design 
requirements that ensure an appropriate safety-related performance is achieved. An 
ESPE may include optional safety-related functions, the requirements for which are 
given in annex A. 

The particular requirements for specific types of sensing function are given in 
other parts of this Standard. 

This Standard does not specify the dimensions of configuration of the detection 
zone and its disposition in relation to hazards in any particular application, nor what 
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constitutes a hazardous state of any machine. It is restricted to the functioning of 
the ESPE and how it interfaces with the machine. 

This Standard may be relevant to applications other than those for the protec- 
tion of persons, for example for the protection of machinery or products from me- 
chanical damage. In those applications additional requirements may be necessary, 
for example when the materials that have to be recognized by the sensing function 
have different properties from those of persons. 

This Standard does not deal with electromagnetic compatibility (EMC) emission 
requirements. 

This part of JIS B 9704 provides general requirements for ESPEs of various types 
employing different methods of sensing. The particular requirements for specific 
types of sensing function will be covered in subsequent parts of this Standard. The 
requirements for ESPEs using active opto-electric protective devices, e.g. light cur- 
tains, are contained in part 2. 

This part refers to the technical suitability of the electro-sensitive protective equip- 
ment. Its application may require the use of substances and/or test procedures that 
could be injurious to health unless adequate precautions were taken. Conformance 
with this Standard in no way absolves either the supplier or the user from statutory 
obligations relating to the safety and health of persons during the use of the equip- 
ment covered by this Standard. 

NOTE : The International Standard corresponding to this Standard is as follows. 

In addition, symbols which denote the degree of cojrespon^^ in 

the contents between the relevant International Standard and JIS are 
IDT (identical), MOD (modified), and NEQ (not equivalent) according 

to ISO/IEC^ 

lEC 61496-1 : 1997 Safety of machinery — Electro-sensitive protective 
equipment — Part 1 : General requirements and tests 

(MOD) 

2 Normative references The following standards contain provisions which, through 
reference in this part of JIS B 9704, constitute provisions of this part. If the indi- 
cation of the year of publication (or the year of coming into effect) is given to these 
referred standards, only the edition of the indicated year constitutes the provision 
of this part but the revision and amendment made thereafter do not apply. 

2.1 JIS 

JIS B 9960-1 : 1999 Safety of machinery — Electrical equipment of machines — 
Part 1 : General requirements 

NOTE : lEC 60204-1 : 1997 Safety of machinery— Electrical equipment of 
machines— Part 1 : General requirements is equivalent to the said stan- 
dard. 

JIS C 0040 : 1999 Environmental testing Part 2 : Tests— Test Fc : Vibration (si- 
nusoidal) 

NOTE : lEC 60068-2-6 : 1995 Environmental testing— Part 2 : Tests— Test Fc : 
Vibration (sinusoidal) is identical with the said standard. 
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JIS C 0042 : 1995 Basic environmental testing procedures Part 2 : Tests Test Eb 
and guidance : Bump 

NOTE : lEC 60068-2-20 ; 1987 Environmental testing— Part 2 : Tests— Test Eb 
and guidance : Bump is identical with the said standard. 

JIS C 0445 ; 1999 Identification of equipment terminals and of terminations of 
certain designated conductors, including general rules for an 
alphanumeric system 

NOTE : lEC 60445 : 1988 Identification of equipment terminals and of termi- 
nations of certain designated conductors, including general rules for 
an alphanumeric system is identical with the said standard. 

JIS C 0447 : 1997 Man-machine interface (MMI) — Actuating principles 

NOTE : lEC 60447 : 1993 Man-machine interface (MMI)— Actuating principles 
is identical with the said standard. 

JIS C 8201-5-1 : 1999 Low-voltage switchgear and controlgear — Part 5-1 : Control 

circuit devices and switching elements — Electromechanical 
control circuit devices 

NOTE : lEC 60947-5-1 : 1997 Low-voltage switchgear and controlgear — Part 
5-1 : Control circuit devices and switching elements — Electromechani- 
cal control circuit devices is equivalent to the said standard. 

JIS C 8480 : 1998 Box-type switchgear assemblies for low-voltage distribution 
purpose, annex 2 

NOTES a) lEC 60439-1 : 1992 Low-voltage switchgear and controlgear assem.- 
blies — Part 1 : Type-tested and partially type-tested assemblies is 
equivalent to the said annex, 

b) lEC 60664-1 : 1992 Insulation coordination for equipment within 
low-voltage systems — Part 1 : Principles, requirements and tests is 
equivalent to the said annex. 

JIS C 0920: 1993 Degrees of protection provided by enclosures (IP Code) 

NOTE : lEC 60529 : 1989 Degrees of protection provided by enclosures (IP code) 
is identical with the said standard. 

JIS C 1000-4-2: 1999 Electromagnetic compatibility (EMC)~Part 4 : Testing and 

measurement techniques — Section 2 : Electrostatic discharge 
immunity test 

NOTE : lEC 61000-4-2 : 1995 Electromagnetic compatibility (EMC)— Part 4 : 
Testing and measurement techniques — Section 2 : Electrostatic discharge 
immunity test — Basic EMC publication is identical with the said stan- 
dard. 

JIS C 1000-4-3 : 1997 Electromagnetic compatibility (EMC)— Part 4 : Testing and 

measurement techniques — Section 3 : Radiated, radio-fre- 
quency, electromagnetic field immunity test 

NOTE : lEC 61000-4-3 : 1995 Electromagnetic compatibility (EMC)— Part 4 : 
Testing and measurement techniques — Section 3 : Radiated, radio-fre- 
quency, electromagnetic field immunity test — Basic EMC publication 
is identical with the said standard. 
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JIS C 1000-4-4 : 1999 Electromagnetic compatibility (EMC)— Part 4 : Testing and 

measurement techniques — Section 4 : Electrical fast tran- 
sient I hurst immunity test 

NOTE : lEC 61000-4-4 : 1995 Electromagnetic compatibility (EMC)— Part 4 : 
Testing and measurement techniques — Section 4 : Electrical fast tran- 
sient I burst immunity test — Basic EMC publication is equivalent to the 
said standard. 

JIS C 1000-4-5 : 1999 Electromagnetic compatibility (EMC)— Part 4 : Testing and 

measurement techniques — Section 5 : Surge immunity test 

NOTE : lEC 61000-4-5 : 1995 Electromagnetic compatibility (EMC)-— Part 4 : 
Testing and measurement techniques — Section 5 : Surge immunity tests 
is equivalent to the said standard. 

JIS C 1000-4-6 : 1999 Electromagnetic compatibility (EMC)— Part 4 : Testing and 

measurement techniques — Section 6 : Immunity to conducted 
disturbances, induced by radio- frequency fields 

NOTE : lEC 61000-4-6 : 1996 Electromagnetic compatibility (EMC)— Part 4 : 
Testing and measurement techniques — Section 6 : Immunity to conducted 
disturbances, induced by radio-frequency fields — Basic EMC publica- 
tion is equivalent to the said standard. 

JIS C 6482 : 1997, JIS C 6484 : 1997, JIS C 6485 : 1997, JIS C 6486 : 1996, JIS 
C 6488 : 1999, JIS C 6489 : 1999, JIS C 6490 : 1998, JIS C 6492 : 1998, JIS C 
6493 : 1999, JIS C 6494 : 1999 Copper-clad laminates for printed wiring boards 

NOTE : lEC 60249-2 : 1985 Base materials for printed circuits— Part 2 : Sped- 
fications is equivalent to the said standard. 

JIS C 9742 : 2000 Isolating transformers and safety isolating transformers— Re- 
quirements 

JIS Z 9901 : 1994 Quality systems — Model for quality assurance in design, de- 
velopment, production, installation and servicing 

NOTE : ISO 9001 ; 1994 Quality systems — Model for quality assurance in de- 
sign, development, production, installation and servicing is identical 
with the said standard. 

2.2 International standards 

lEC 60050(191) : 1990 International Electrotechnical Vocabulary (lEV)— Chap- 
ter 191 : Depend-ability and quality of service 

lEC 61310-1 : 1995 Safety of machinery — Indication, marking and actuation — 
Part 1 : Requirements for visual, auditory and tactile signals 

2.3 Bibliography 

TR B 0008 : 1999 Safety of machinery — Basic concepts, general principles for 
design— Part 1 : Basic terminology, methodology 

NOTE : ISO/TR 12100-1 : 1992 Safety of machinery— Basic concepts, general 
principles for design — Part 1 : Basic terminology, methodology is identical 
with the said technical report. 



PROTECTED BY COPYKIGHT 



5 
B 9704-1 : 2000 (lEC 61496-1 : 1997) 

TR B 0009 : 1999 Safety of machinery — Basic concepts, general principles for 
design— Part 2 : Technical principles and specifications 

NOTE : ISO/TR 12100-2 : 1992 Safety of machinery— Basic concepts, general 
principles for design — Part 2 : Technical principles and specifications 
is identical with the said technical report, 

3 Definitions For the purpose of this part of JIS B 9704, the following defini- 
tions apply. 

3.1 electro-sensitive protective equipment (ESPE) An assembly of devices and/ 
or components working together for protective tripping or presence-sensing purposes 
and comprising as a minimum: 

— a sensing device; 

— controlling/monitoring devices; 

— output signal switching devices. 

NOTE : The safety-related control system associated with the ESPE, or the ESPE 
itself, may further include a secondary switching device, muting func- 
tions, stopping performance monitor, etc. (see annex A). In order to assist 
in the understanding of the inter-relationship of the various major ele- 
ments of the ESPE and the associated safety-related control systems, 
block schematic diagrams are included as figures A.l and A.2. 

3.2 controlling/monitoring device The part of the electro-sensitive protective 
equipment (ESPE) that: 

— receives and processes information from the sensing device and provides signals 
to the output signal switching devices (OSSDs); 

— monitors the sensing device and the OSSDs. 

3.3 defined signal range The permissible signal range within which the safety- 
related signal threshold values have been set and are detected by the sensing de- 
vice. 

3.4 detection capability The sensing function parameter limit specified by the 
supplier that will cause actuation of the electro-sensitive protective equipment (ESPE). 

3.5 detection zone The zone within which a specified test piece will be detected 
by the electro-sensitive protective equipment (ESPE). 

3.6 external device monitoring (EDM) A means by which the electro-sensitive 
protective equipment (ESPE) monitors the state of control devices which are exter- 
nal to the ESPE. 

3.7 failure The termination of the ability of an item to perform a required func- 
tion. [lEV 191-04-01] 

NOTE : lEV — International Electrotechnical Vocabulary 
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NOTES 1 After failure the item has a fault. 

2 "Failure" is an event, as distinguished from "fault", which is a state. 

3 This concept as defined does not apply to items consisting of software 
only. 

4 In practice the terms fault and failure are often used synonymously. 

3*8 failure to danger A failure which prevents or delays all output signal switching 
devices (OSSDs) going to, and/or remaining in the OFF-state in response to a condi- 
tion which, in normal operation, would result in their so doing. 

3.9 fault The state of an item characterized by inability to perform a required 
function, excluding the inability during preventive maintenance or other planned 
actions, or due to lack of external resources. 

NOTES 1 A fault is often the result of a failure of the item itself, but may exist 
without prior failure. 

2 In English the term "fault" and its definition are identical with those 
given in lEV 191-05-01, 

3.10 final switching device (FSD) The component of the machine's safety-re- 
lated control system that interrupts the circuit to the machine primary control ele- 
ment (MPCE) when the output signal switching device (OSSD) goes to the OFF-state 
(see figures A,l and A. 2). 

3.11 integrated circuit — complex or programmable A monolithic, hybrid or 
module circuit, where the internal connections are not accessible, which satisfies one 
or more of the criteria below: 

a) more than 1 000 gates are used in the digital mode; 

b) more than 24 functionally different external electrical connections are available 
for use; 

c) the functions can be programmed, 

NOTES 1 Examples include ASICs, ROMs, PROMs, EPROMs, PALs, CPUs, PLAs, 
and PLDs. 

2 The circuits may function in the analogue mode, in the digital mode, 
or in a combination of the two modes. 

3.12 integrated circuit — simple A monolithic, hybrid or module circuit, where 
the internal connections are not accessible, and which satisfies none of the criteria 
in 3.11, 

NOTES 1 Examples are SSI or MSI logic ICs, comparators. 

2 The circuits may function in the analogue mode, in the digital mode, 
or in a combination of the two modes. 

3.13 lock-out condition A condition, initiated by a fault, preventing normal op- 
eration of the electro-sensitive protective equipment (ESPE) which is automatically 
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attained when all output signal switching devices (OSSDs) and, where applicable, 
all final switching devices (FSDs) and secondary switching devices (SSDs) are sig- 
nalled to go to the OFF-state. 

3-14 machine primary control element (MPCE) The electrically powered element 
that directly controls the normal operation of a machine in such a way that it is the 
last element (in time) to function when machine operation is to be initiated or arrested. 

NOTE : This element can be, for example, a mains contactor, a magnetic clutch 
or an electrically operated hydraulic valve. 

3-15 machine secondary control element (MSCE) A machine control element, 
independent of the machine primary control element(s), that is capable of removing 
the source of power from the prime mover of the relevant hazardous parts. 

NOTES 1 When fitted, the MSCE is normally controlled by the secondary switch- 
ing device. 

2 This element can be, for example, a mains contactor, a magnetic clutch 
or an electrically operated hydraulic valve. 

3.16 muting A temporary automatic suspension of a safety function(s) by safety- 
related parts of the control system. 

NOTE : For ESFE-muting see A.7. 

3.17 OFF-state The state in which the output circuit is interrupted and does not 
permit the flow of current. 

3.18 ON-state The state in which the output circuit is complete and permits the 
flow of current. 

3.19 output signal switching device (OSSD) The component of the electro-sen- 
sitive protective equipment (ESPE) connected to the control system of the machine 
which, when the sensing device is actuated during normal operation, responds by 
going to the OFF-state, 

3.20 overall system stopping performance The time interval resulting from 
the sum of the electro-sensitive protective equipment (ESPE) response time and the 
time to the cessation of hazardous machine operation. 

3.21 response time The maximum time between the occurrence of the event leading 
to the actuation of the sensing device and the output signal switching devices (OSSDs) 
achieving the OFF-state. 

3.22 restart interlock A means of preventing automatic restarting of a machine 
after actuation of the sensing device during a hazardous part of the operating cycle 
of the machine, after a change in mode of operation of the machine, and after a change 
in the means of start control of the machine. 

NOTE : Modes of operation include inch, single stroke, automatic. Means of start 
control include foot switch, two-hand control, and single or double actua- 
tion of the electro-sensitive protective equipment (ESPE) sensing device. 
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3.23 safety-related part of a control system A part or subpart(s) of a control 
system which respoiid(s) to input signals and generate(s) safety-related output sig- 
nals. The combined safety-related parts of a control system start at the points where 
the safety-related signals are initiated and end at the output of the power control 
elements. This also includes monitoring systems. 

3.24 secondary switching device (SSD) A device which, in a lock-out condi- 
tion, performs a back-up safety function by going to the OFF-state and initiating an 
appropriate machine control action, e.g. de-energizing the machine secondary con- 
trol element (MSCE). 

3*25 sensing device That part of the electro-sensitive protective equipment (ESPE) 
which uses electro-sensitive means to determine the event or state that the ESPE is 
intended to detect, for example in an opto-electronic device the sensing function would 
detect an opaque object entering the detection zone. 

3.26 start interlock A means which prevents an automatic machine start when 
the electrical supply to the electro-sensitive protective equipment (ESPE) is switched 
on, or is interrupted and restored. 

3.27 start test A manual or automatic test which is performed after the electro- 
sensitive protective equipment (ESPE) has been switched on in order to test its complete 
safety-related control system before normal machine operation is initiated. 

3*28 stopping performance monitor (SPM) A monitoring means to determine 
whether or not the overall system stopping performance is within the preset limit(s). 

3.29 supplier An entity (e.g. manufacturer, contractor, installer, integrator) who 
provides equipment or services associated with the machine, 

NOTE : The user may act in the capacity of a supplier to himself. 
4 Functional, design and environmental requirements 
4.1 Functional requirements 

4.1.1 Normal operation In normal operation the ESPE shall respond by giving 
(an) appropriate output signal(s) when part of a person or an object enters, or is in 
the detection zone, or when the signal from a sensing device is within a defined sig- 
nal range. 

The ESPE response time shall not exceed that stated by the supplier. No means 
of adjustment of the response time shall be made available to the user. 

4.1.2 Sensing function The sensing function shall be effective over the detec- 
tion zone or the defined signal range specified by the supplier. No adjustment of 
the detection zone or the defined signal range shall be possible without the use of a 
key, key-word or tool. 
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4.1.3 Types of ESPE In this Standard, four types of ESPE are considered and it 
is the responsibility of the machine manufacturer and/or the user to prescribe which 
type is required for a particular application. 

A type 1 ESPE shall fulfil the fault detection requirements of 4,2,2,2. 

A type 2 ESPE shall fulfil the fault detection requirements of 4.2. 2*3. 

For a type 1 ESPE and for a type 2 ESPE, in normal operation the output circuit 
of at least one OSSD shall go to the OFF-state when the sensing device is actuated, 
or when power is removed from the device. 

A type 3 ESPE shall fulfil the fault detection requirements of 4.2,2,4. 

A type 4 ESPE shall fulfil the fault detection requirements of 4.2.2,5. 

For a type 3 ESPE and for a type 4 ESPE, in normal operation the output circuit 
of at least two OSSDs shall go to the OFF-state when the sensing function is actu- 
ated, or when power is removed from the device. 

4.2 Design requirements 

4.2.1 Electrical supply The ESPE shall be designed to operate correctly with the 
conditions of the nominal supply as specified below, unless otherwise specified by 
the user: 

AC supplies 

Voltage 0.85 to 1.1 of nominal voltage. 

Frequency 0.99 to 1.01 of nominal frequency (continuously); 

0.98 to 1.02 of nominal frequency (short-time). 

Harmonics Harmonic distortion not to exceed 10 % of the total r.m.s. 

voltage between live conductors for the sum of the second 
through to the fifth harmonic. An additional 2 % of the total 
r.m.s. voltage between live conductors for the sum of the 
sixth through to the 30th harmonic is permissible. 

DC supplies 

From batteries 

Voltage 0.85 to 1.15 of nominal voltage; 

0.7 to 1.2 of nominal voltage in the case of battery-operated 
vehicles. 

From converting equipment 

Voltage 0.9 to 1.1 of nominal voltage. 

Ripple (peak to peak) Not to exceed 5 % of nominal voltage. 

Any a.c. supplied ESPE or any type 4 d.c. supplied ESPE shall be provided with 
its own dedicated means of isolation from the supply source either by the use of an 
isolating transformer conforming to JIS C 9742 or by an equivalent means of isola- 
tion. 
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When the ESPE incorporates a battery and is capable of being operated whilst 
the batteries are being charged, the charger shall incorporate an isolating trans- 
former conforming to JIS C 9742. 

4*2.2 Fault detection requirements 

4.2.2.1 General The ESPE shall respond to the faults listed in annex B, in ac- 
cordance with 4.2.2.2 to 4.2.2.5 as appropriate. 

4.2.2.2 Particular requirements for a type 1 ESPE Under consideration. 

4.2.2.3 Particular requirements for a type 2 ESPE A type 2 ESPE shall have 
a means of periodic test to reveal a failure to danger (e.g. loss of detection capabil- 
ity, response time exceeding that specified). The test signal shall simulate the ac- 
tuation of the sensing device and the duration of the periodic test shall be as specified 
in the relevant part of JIS B 9704. Where the periodic test is intended to be initi- 
ated by an external (e.g. machine) safety-related control system, the ESPE shall be 
provided with suitable input facilities (e.g. terminals). 

At start-up (e.g. at switch-on), the OSSD(s) shall not attain the ON-state until a 
periodic test has been carried out and no fault has been detected. 

A single fault affecting normal operation (e.g. loss of detection capability, increase 
in response time) shall be detected: 

— immediately; or 

— as a result of the next periodic test; or 

— on actuation of the sensing device, 

and shall result in one of the following actions: 

— initiation of a lock-out condition within the ESPE; or 

— for an ESPE with only one OSSD, the generation of an initiating signal to 
enable an external (e.g. machine) safety-related control system to perform the 
lock-out function. 

NOTE : A SSD may fulfil this function. 

It shall not be possible for the ESPE to achieve an automatic reset from a lock- 
out condition by interruption and restoration of the mains power supply when the 
fault which initiated the lock-out condition is still present. 

4.2.2.4 Particular requirements for a type 3 ESPE Under consideration. 

4.2*2.5 Particular requirements for a type 4 ESPE A single fault resulting 
in a loss of detection capability shall cause the ESPE to go to a lock-out condition 
within the response time. 

A single fault resulting in an increase in response time beyond the specified value 
or preventing one or more than one OSSD going to the OFF-state, shall cause the 
ESPE to go to a lock-out condition immediately, i.e. within the response time, or 
immediately upon any of the following demand events where fault detection requires 
a change of state: 
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— - on actuation of the sensing device; 

— on switch off/on; 

— on reset. 

It shall not be possible for the ESPE to achieve an automatic reset from a lock- 
out condition by interruption and restoration of the mains power supply when the 
fault which initiated the lock-out condition is still present. 

In cases where a single fault which in itself does not cause a failure to danger is 
not detected, the occurrence of further faults shall not cause a failure to danger. 
For verification of this requirement see 5,3.5. 

NOTES 1 Design measures for a type 4 ESPE may include: 

— single-channel technique with dynamic fault detection measures; 
or 

— single-channel technique with an internally generated automatic 
check, performed frequently so that the automatic check interval 
for fault detection is included in the response time; and 

— multiple channel techniques such that any disparity between chan- 
nels results in a lock-out condition, 

2 For additional requirements for integrated circuits, complex or pro- 
grammable, see 4.2.10. 

4.2.3 Electrical equipment of the ESPE 

4.2.3.1 General The electrical equipment (components) of the ESPE shall: 

— conform to JIS standards where they exist; 

— be suitable for the intended use; and 

— be operated within their specified ratings. 

4.2.3.2 Protection against electric shock Protection against electric shock shall 
be provided in accordance with 6.1 of JIS B 9960-1. 

4.2.3.3 Protection of electrical equipment Overcurrent protection shall be pro- 
vided in accordance with 7.2,1, 7,2.3, 7.2.7, 7.2.8, and 7.2.9 of JIS B 9960-1. 

NOTE : Information may need to be given to the user of the ESPE as to the maxi- 
mum rating of fuses, or setting of an overcurrent protective device for the 
circuit(s) connected to the OSSD(s) output connection points. 

4.2.3.4 Pollution degree The electrical equipment shall be suitable for pollution 
degree 2 (see 6,1.2.3 of annex 2 of JIS C 8480). 

4.2.3.5 Clearance, creepage distances and isolating distances The electri- 
cal equipment shall be designed and constructed in accordance with 7.1.2 of annex 2 
of JIS C 8480. 

4.2.3.6 Wiring The electrical equipment shall be wired in accordance with 7.8,3 
of annex 2 of JIS C 8480, 
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4.2.4 Output signal switching devices (OSSDs) Separate output connections 
points (terminals) shall be provided for each OSSD. 

The OSSDs should be so rated that their loads can be switched without the use 
of arc suppression devices. 

In the interest of improved reliability, it is strongly recommended that switching 
voltage-suppression devices are fitted, which should be connected across the loads 
and not across the contacts. 

The output circuit(s) of the OSSDs should be adequately protected to prevent failure 
to danger, for example welded contacts under overcurrent conditions (see 7.2.9 of 
JIS B 9960-1). 

Some functions of the safety-related control system of the machine may be per- 
formed by the ESPE, for example of OSSD may perform the function of a FSD. Both 
a type 3 ESPE and a type 4 ESPE shall incorporate a minimum of two OSSDs. 

4.2.5 Indicator lights and displays Devices shall be provided to: 

a) indicate the actuation of the sensing device. Neither the time from the actua- 
tion of the sensing device to the indicator achieving 50 7c of its final brightness 
(luminescence), nor the time from the de-actuation of the sensing device to the 
indicator brightness deca3dng to 50 % of its initial brightness, shall exceed 100 ms; 

b) indicate the output status of an OSSD. The ON-state shall be represented by 
a green indicator, the OFF-state by a red indicator. 

4.2.6 Adjustment means All adjustment means shall be so designed that a fail- 
ure to danger is not possible at any point in the range of adjustment. 

4.2.7 Disconnection of subsystems When means are provided to permit discon- 
nection of any subsystem, part of a subsystem or any plug-in component, such dis- 
connection shall result in at least one OSSD going to the OFF-state, in accordance 
with 4.2.2. 

4.2.8 Noe-electrical components Non-electrical components shall be suitable for 
the intended use. 

4.2.9 Common cause failures The design should be such as to minimize the pos- 
sibility of a failure to danger from common cause failures arising from: 

— environmental influences; 

— multichannel systems using a common substrate; 

— short circuits between channels of multichannel systems. 

NOTE : Common cause failure can also result from the use of components de- 
graded by mishandling, faulty manufacture, etc. 

None of the components in a common semi-conductor substrate shall be used for 
more than one channel of a multichannel system. 
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4-2.10 Programinable or complex integrated circuits Where programmable 
or complex integrated circuits are used in a type 4 ESPE, the safety-related perfor- 
mance shall be maintained by two independent controlling/monitoring channels. This 
requirement shall be verified in accordance with 5,5. 

4.2,11 Software, programming, fimctioiial design of integrated circuits 

4.2.11.1 General Where an ESPE implements its safety-related performance by 
any of the following means, the additional requirements of 4,2*11,2 shall apply: 

a) a software program(s) executed during operation; 

b) a programmed device(s), the functions of which were set by a process subse- 
quent to its original manufacture, e.g. PAL, PLA, PLD, PROM; 

c) a device(s) manufactured to a specific user functional specification, e.g. ASIC, 
mask programmed microprocessor, ROM. 

Conformance to these requirements shall be validated in accordance with 5.5. 

4.2.11.2 Requirements 

a) The software, device program and device function design shall be developed within 
a quality management system that meets the requirements of JIS Z 9901, 

b) Documentary evidence shall be available under the quality management sys- 
tem procedures to demonstrate that the required level of safety-related perfor- 
mance has been achieved. 

c) Prior to any development, the conceptual design of the ESPE shall be analysed 
for the identification of hazards and failure modes, in order to identify, in a safety 
requirements specification, the ESPE safety-related functions. Some or all of the 
ESPE safety-related functions shall then be allocated to the means in 4.2,11, and 
the required safety-related performance for each element shall be determined. 
Suitable engineering techniques for specification, design, implementation and 
maintenance shall be adopted to achieve the required safety-related performance. 

d) A documented quality plan, clearly identifying the stages of development, and 
setting out the acceptance criteria for each stage, shall be produced. Examples 
of development stages are requirements specification, design specification, veri- 
fication, and validation. 

e) The requirements for software, program design, and functional design, for each 
part relevant to 4.2,11.1 shall be complete and unambiguous. Each require- 
ments specification shall enable an assessor or validator (i.e. a person other than 
the designer) to trace back readily to the safety requirements specification to 
confirm that the required safety-related functions are adequately addressed. 

f) A comprehensive test plan shall be devised in order to demonstrate that the 
working design is a correct implementation of the safety-related functions re- 
quired by the safety requirements specification. The test of software, program, 
and functional specification, shall be documented in the project records as evi- 
dence that the design satisfies the safety requirements specification. 
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g) The software, program design, and functional specification design, shall be subject 
to effective configuration management and change control. During development, 
effective procedures shall confirm that changes in requirements, specification, 
design, etc. are adequately documented and that the impact of all changes is 
analysed to confirm that the safety requirements specification remains trace- 
able through to the v^orking design. The working design shall be protected from 
unauthorized change, and its precise configuration (e.g. list of modules, version 
number) shall be recorded accurately. 

h) Where a software program is executed during operation of the ESPE, the entire 
operational instruction software shall be contained in read-only memory which 
cannot be overwritten by the processor. Appropriate techniques shall be included 
to monitor correct program flow, and to confirm the integrity of the software. Such 
techniques can include a watchdog, RAM/ROM checks, CPU test, etc. 

i) Where software tools such as compilers or translators (but not assemblers) are 
used to develop software, software diversity shall not be considered to be present 

unless: 

— the software tools used for the diverse programs are entirely unrelated; or 

— the test plan incorporates adequate measures to detect common cause er- 
rors introduced by the software tool. 

j) As a principle of design, the safety-related software shall be isolated, as far as 
is practicable, from non-safety-related software in order to minimize the possi- 
bility of corruption of the safety functions, and to assist the task of assessing 
the safety performance. 

4-3 Environmental requirements 

4.3.1 Ambient air temperature range and humidity The ESPE shall comply 
with the requirements of this Standard when subjected to ambient temperature varia- 
tions from ^C to 50 ^C. Where it is intended for use outside this range, the sup- 
plier shall specify the temperature range over which the system will continue in normal 
operation. Compliance with this requirement shall be verified by the tests specified 
in 5.4.2 at a non-condensing humidity of 95 % for temperatures between 20 "^C and 
the highest ambient temperature according to 5,4,2, 

4.3.2 Electrical disturbances 

4.3.2,1 Supply voltage variations The ESPE shall not fail to danger when the 
external supply voltage is reduced steadily and continuously from the nominal volt- 
age to zero voltage, over a period of 10 s to 20 s, and then increased in a similar 
manner from zero voltage to the nominal voltage. 

The ESPE shall not fail to danger when each internally derived supply voltage, 
in turn, is varied steadily and continuously over a period of 10 s to 20 s, from nomi- 
nal voltage to zero voltage, and then increased in a similar manner from zero volt- 
age to nominal voltage. 

4*3.2.2 Supply voltage interruptions When supply voltage interruptions (dips) 
are applied as follows: 
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Test number 


Dip value of rated voltage 


Dip time 


Dip repetition rate 




% 


Ms 


Hz 


1) 


100 


10 


10 


2) 


50 


20 


5 


3) 


50 


500 


0.2 



the ESPE shall respond to test 1) and to test 2) by continuing in normal operation, 
and to test 3) by not failing to danger, 

4*3,2.3 Fast transient/burst 

4.3.2.3.1 General requirements The ESPE shall continue in normal operation 
when subjected to fast transient/burst in accordance with JIS C 1000-4-4; 



Ports for power lines for less than 50 V a.c. or d.c. 
Ports for signal lines etc. with a length exceeding 1 m 


1 kV (peak) according to test severity level 2 
of JIS C 1000-4-4 


Ports for power lines for 50 V a.c. and above 


2 kV (peak) according to test severity level 3 
of JIS C 1000-4-4 



4.3.2,3,2 Additional requirements A type 4 ESPE shall not fail to danger when 
subjected to fast transient/burst in accordance with JIS C 1000-4-4: 



Ports for power lines for d.c, and for less than 50 V a.c. 
Ports for signal lines etc. with a length exceeding 1 m 


2 kV (peak) according to test severity level 3 
of JIS C 1000-4-4 


Ports for power hnes for 50 V a.c. and above 


4 kV (peak) according to test severit3^ level 4 
of JIS C 1000-4-4 



4.3.2.4 Fast transient/surge 

4.3.2.4.1 General requirements The ESPE shall continue in normal operation 
when subjected to fast transient/surge in accordance with JIS C 1000-4-5: 



Ports for signal lines 

Power ports for d.c. and for less than 50 V a.c. 


1 kV (peak) common mode according to test 
severity level 2 of JiS C 1000-4-5 


Ports for power lines for 50 V a.c. and above 


2 kV (peak) common mode and 1 kV (peak) 
differential mode according to test severity 
level 3 of JIS C 1000-4-5 



4.3.2.4.2 Additional requirements A type 4 ESPE shall not fail to danger when 
subjected to fast transient/surge in accordance with JIS C 1000-4-5: 



Powxr ports for d.c. and for less than 50 V a.c. 
Ports for signal lines 


2 kV (peak) common mode according to test 
severity level 3 of JIS C 1000-4-5 


Power ports for 50 V a.c. and above 


4 kV (peak) common mode and 2 kV (peak) 
differential mode according to test severity 
level 4 of JIS C 1000-4-5 
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4.3.2.5 Electromagnetic field 

4*3*2,5*1 General requirements The ESPE shall continue in normal operation 
when subjected to an electromagnetic field in accordance with JIS C 1000-4-3: 

10 V/m according to test severity level 3 of JIS C 1000-4-3 

4.3.2.5.2 Additional requirements A type 4 ESPE shall not fail to danger when 
subjected to an electromagnetic field in accordance with JIS C 1000-4-3; 

30 V/m according to test severity level X of JIS C 1000-4-3 

4.3.2.6 Conducted disturbances induced by radio-frequency fields 

4,3.2.6.1 General requirements The ESPE shall continue in normal operation 
when subjected to conducted radio-frequency disturbances in accordance with JIS C 
1000-4-6: 



Ports for signal lines etc, with a length of 1 ra to 10 m 


3 V (r.m.s.) according to test severity level 2 
of JIS C 1000-4-6 


Ports for signal lines with a length exceeding 10 m 
Power ports. Earth ports 


10 V (r.m.s.) according to test severity level 3 
of JIS C 1000-4-6 



4.3*2.6,2 Additional requirements A type 4 ESPE shall not fail to danger when 
subjected to conducted radio-frequency disturbances in accordance with JIS C 1000- 

4-6: 



Ports for signal lines etc. with a length of 1 m to 10 m 


10 V (r.m.s.) according to test severity level 3 
of JIS C 1000-4-6 


Ports for signal lines with a length exceeding 10 m 
Power ports. Earth ports 


30 V (r.m.s.) according to test severity level X 
of JISClOOO-4.6 



4.3.2.7 Electrostatic discharge 

4.3.2.7.1 General requirements The ESPE shall continue in normal operation 
when subjected to an electrostatic discharge in accordance with JIS C 1000-4-2: 

6 kV contact or 8 kV air discharge, 
according to test severity level 3 of JIS C 1000-4-2 

4.3.2.7.2 Additional requirements A type 4 ESPE shall not fail to danger when 
subjected to an electrostatic discharge in accordance with JIS C 1000-4-2: 

8 kV contact or 15 kV air discharge, 
to test severity level 4 of JIS C 1000-4-2 

4,3.3 Mechanical environment 

4.3,3.1 Vibration The ESPE shall be capable of continuing in normal operation 
during the vibration tests of 5.4.4.1. 
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4.3. S.2 Bump The ESPE shall be capable of continuing in normal operation dur- 
ing the bump tests of 5.4.4.2. 

4.3.4 Enclosures The ESPE shall have its own enclosure(s). 

All enclosures of the ESPE, including those mounted remotely, shall provide a 
degree of protection of at least IP54 (see JIS C 0920), when mounted as specified by 
the supplier. However, when mounted in a machine controlgear enclosure having a 
degree of protection of at least IP54, the ESPE enclosure shall have a degree of 
protection of at least IP20. 

NOTE : Protection against mechanical damage may be achieved by: 

— a suitable location; 

— the use of suitable materials and form of construction providing ad- 
equate strength; or 

— the use of a protective barrier. 

The method of cable entry for incoming cables shall not impair the degree of pro- 
tection. 

Sealing compounds which adhere to the two surfaces being joined, such that the 
environmental protection is degraded when the joint is separated, shall not be used 
to seal covers which might be removed for service access. 

Enclosures shall be free from sharp edges or corners capable of causing damage 
to cable insulation. Compliance shall be checked by inspection. 

Enclosures shall provide adequate access to enable any necessary adjustments 
and maintenance work to be carried out safely and effectively. The covers enabling 
such access shall have captive fasteners 

5 Testing 

5.1 General 

5.1.1 Type tests 

5*1»1*1 Test samples In so far as it is practicable, all parts of an ESPE shall be 
tested together. Where this is not practicable, parts of the ESPE may be tested 
separately. Examples of such situations include integrated ESPEs (ESPEs integrated 
in, and normally not separable from machinery) in the case of environmental tests. 
In such cases: 

— any input signals necessary for the operation of the ESPE shall be simulated; 

— these exceptions and any omissions of tests shall be stated in the test report. 

Where a particular test would be destructive and identical results could be ob- 
tained by testing part of ESPE in isolation, a sample of that part may be used in- 
stead of the whole equipment sample for the purpose of obtaining the results of the 
test. 

Where the ESPE is designed for operation at a number of different supply volt- 
ages (e.g. for differing applications), more than one sample may be required. 
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When the ESPE is designed to be supplied from an external dedicated power supply, 
the ESPE shall undergo testing with the specified dedicated power supply. 

5.1.1,2 Operating condition Unless otherwise sated in the test procedure^ the 
tests shall be carried out w^ith the test sample operating wuthin the conditions speci- 
fied in the accompanying documents. 

For the purposes of electrical disturbance immunity tests, the equipment shall 
be in as near its final operating configuration as is possible (i.e. with all peripheral 
devices and covers attached, connected to the power supply and, where applicable, 
connected to the external protective conductor). When several mounting positions 
are specified, the least favourable mounting position shall be used. 

5.1*2 Test conditions 

5.1.2.1 Test environment Except where otherwise specified in 5.4, the tests shall 
be carried out with the ESPE operated under the following conditions: 

— rated voltage (or a voltage within the rated voltage range); 

— rated frequency (or a frequency within the rated frequency range); 

— ambient temperature: 20 ^C±5 °C; 

— relative humidity: 25 % to 75 %; 

— barometric pressure: 86 kPa to 106 kPa. 

NOTE : Values stated in the marking and in the accompanying documents are 
considered as rated values. 

5.1.2.2 Measurement accuracy The errors of measurement shall not exceed: 

— for measurement of ESPE response time: ± 1 ms; 

— for temperature measurements: ±3 °C; 

— for electrical measurements: ± 1 %> where technically possible and/or appro- 
priate; 

— for relative humidity (KH) measurements: ±3% RH; 

— for linear measurements: ± 1 mm or ± 1 %, whichever is the greater. 

All measurements shall be made after stable temperature conditions have been 
achieved. This is considered to be fulfilled when the rate of temperature rise or fall 
is less than 2 K/h. 

5tl,3 Test results The results of the tests listed in this clause shall be documented. 
The test results shall be arranged in a form that shows the details of each indi- 
vidual test and its effects. Details of any special test procedures shall be included 
in the test report. 

5.2 Functional tests 

5.2,1 Sensing function and detection capability 
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5.2*1*1 Sensing function The sensing function of the ESPE shall be tested as 
specified in the relevant part of JIS B 9704. 

5.2.1.2 Integrity of the detection capability It shall be verified that the de- 
tection capability is maintained, or the ESPE does not fail to danger, by systematic 
analysis of the design employed, using tests where appropriate, as specified in the 
relevant part of JIS B 9704. 

The results of the systematic analysis shall identify which tests in 5*4 require, 
in addition, a measurement of the response time. 

5.2*2 Response time The response time shall be verified by systematic analysis 
and test. 

The response time may be determined by electrical simulation of an actuation, 
provided that it includes the maximum time between the event triggering the ac- 
tuation of the sensing device and the actuation. 

Specific requirements for the measurement of the response time of the ESPE are 
given in the relevant part of JIS B 9704. 

5*2,3 Limited functional tests 

5.2.3.1 General The following limited functional tests A, B and C shall be per- 
formed to verify that under normal environmental conditions the ESPE shall con- 
tinue in normal operation and that, under abnormal environmental conditions and 
under fault conditions, the ESPE shall not fail to danger should it not continue in 
normal operation. 

When an ESPE is fitted with a restart interlock function, that function shall be 
by-passed or not selected during the performance of the tests. The restart interlock 
function shall be tested separately (see annex A). 

5.2.3.2 Limited functional test A (A-test) With no intrusion in the detection 
zone or with no other defined initiation, it shall be observed, for a period of at least 
5 s, unless otherwise specified, that the OSSD(s) shall be in the ON~state and shall 
not go to OFF-state. 

5.2.3.3 Limited functional test B (B-test) With no intrusion in the detection 
zone or with no other defined initiation, it shall be observed, for a period of at least 
5 s, unless otherwise specified, that the OSSD(s) shall be in the ON-state and shall 
not go to the OFF-state. 

The test piece shall be brought into the detection zone or a defined initiation shall 
take place. 

The OSSD(s) shall respond by going from the ON-state to the OFF-state within 
the ESPE response time. It shall be observed that, for a period of at least 5 s unless 
otherwise specified, the OSSD(s) remain(s) in the OFF-state with the test piece be- 
ing present in the detection zone, or otherwise stay(s) actuated. 

The test piece shall be removed from the detection zone or the sample shall be 
otherwise deactuated. The OSSD(s) shall respond by going from the OFF-state to 
the ON-state. It shall be observed that, for a period of at least 5 s unless otherwise 
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specified, the OSSD(s) remain(s) in the ON-state with the test piece not being present 
in the detection zone, or otherwise stay(s) physically deactuated. 

5.2.3*4 Limited functional test C (C-test) This test is the same as the limited 
functional test B but, where the OSSD(s) should be in the ON-state, the OSSD(s) 
is(are) allowed to be in the OFF-state. No failure to danger shall occur. At the end 
of each of the relevant tests in 5.4 the ESPE shall operate normally immediately or 
following recovery from a lock-out condition. 

5.2.4 Periodic check For a type 2 ESPE, the application of the periodic test sig- 
nal to cause the OSSD(s) to go to the OFF-state shall be monitored. The total time 
for the test shall not exceed 150 ms. 

5.2.5 Indicator lights and displays The functions and colours of indicator lights 
and displays shall be verified in accordance with the requirements of 4.2.5 by apply- 
ing a B-test. 



5.2.6 Means of adjustment The requirements of 4.1.1 and 4.1.2 shall be veri- 
fied by inspection. The requirements of 4.2.6 shall be verified by inspection and by 
carrying out C-tests as necessary. 



5.2.7 Rating of components The operation of each component within its speci- 
fied ratings, throughout the entire operating range of the ESPE, shall be verified by 
analysis and/or inspection. 

5.2.8 Output signal switching devices (OSSDs) The provision of separate out- 
put connection points (terminals) for each OSSD shall be verified by inspection. 

5.3 Performance testing under fault conditions 

5.3.1 General Tests for the effects of single faults selected according to 4.2.2 shall 
be carried out on all the relevant components of the ESPE, If further faults occur 
as a result of the first single fault, the first and all consequent faults shall be con- 
sidered as a single fault. 

In order to reduce unnecessary testing according to 5.3.2, 5.3.3, 5.3.4 and 5.3.5 
where the results of a combination of faults can be precisely defined theoretically, 
an analysis statement shall be included as part of the test results statement. That 
statement shall be validated in accordance with 5.5.4. In such cases, only selected 
(sample) tests need be carried out to confirm such analysis statements. 

NOTE : In the case of complex circuit structures or components (e.g. micropro- 
cessor, complete redundancy) the review of faults is generally carried 
out on the structural level, i.e. based on assembled groups. See B.1.2 
for exclusion of short circuits on assembled circuit boards. See B.1.3 
and B.1.4 for exclusion of short circuits between adjacent terminals for 
external connection. 

5.3.2 Type 1 ESPE Under consideration. 
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5.3,3 Type 2 ESPE The ESPE shall be subjected to single faults to establish that 
a fault affecting normal operation results in a lock-out condition in accordance with 

4.2,2.3. 

5,3A Type 3 ESPE Under consideration. 

5,3.5 Type 4 ESPE The ESPE shall be subjected to single faults to estabUsh that 
the fault is detected by the ESPE going to a lock-out condition and that no failure to 
danger occurs, in accordance with 4.2.2*5. 

When a single fault is not detected and the analysis specified in 5.3,1 cannot be 
carried out, the tests for the ESPE going to a lock-out condition and no failure to 
danger occurring shall be continued with that fault applied first and all other faults 
added and removed in turn. Tests shall be carried out for all undetected single faults. 

When a sequence of two faults is not detected and the analysis specified in 5.3.1 
cannot be carried out, the tests shall be continued for those two faults, applied in 
sequence, and all other single faults added and removed in turn. No failure to dan- 
ger shall occur. Tests shall be carried out for all undetected double faults. 

Testing for the accumulation of more than three faults need not be carried out 
provided that the probability of more than three faults, largely independent of each 
other and having to appear in a specific sequence in time, is low. 

5.4 Environmental tests 

5.4.1 Rated supply voltage The design measures specified in 4,2,1 shall be verified 
by inspection. 

The ESPE shall be subjected to the following sequence of tests using the relevant 
values specified in 4.2,1: 

a) the ESPE shall be supplied with the lowest rated supply voltage. A B-test shall 
be carried out; 

b) the supply voltage shall be increased, within a period of 10 s to 20 s, to the highest 
rated voltage, during which time an A-test shall be performed; 

c) after the highest test supply voltage has been reached, a B-test shall be carried 
out. 

The requirements for frequency variation and for harmonic distortion shall be 
verified either hy testing or by using analytical methods. 

5.4.2 Ambient temperature variation and humidity The highest ambient tem- 
perature in the tests below shall be as specified in the marking and/or the accompa- 
nying documents, but shall be not lower than +50 ""C. The lowest ambient temperature 
in the tests below^ shall be as specified in the marking and/or the accompanying docu- 
ments, but shall be not higher than °C. 

The ESPE shall be subjected to the following sequence of tests: 

a) With the ESPE operating under the conditions specified in 5.1,2,1 , an A-test 
shall be performed w^ith a duration of at least 2 h. At the end of that time, a B- 
test shall be carried out. 
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b) The ambient temperature shall be increased by not more than 0.3 '^C per minute 
up to the highest ambient temperature, during which time an A-test shall be 
performed. 

c) An A-test shall be performed with a duration of at least 2 h at the highest am- 
bient temperature. During that time, the humidity shall be increased to 95 % 
and held at that value for at least 1 h. Following the A-test, a B-test shall be 
carried out. 

d) The ambient temperature shall be decreased by not more than 0,3 °C per minute, 
whist maintaining the humidity at 95 %, until a temperature of 20 ""C is reached, 
during which time an A-test shall be performed. 

e) The ambient temperature shall be decreased by not more than 0.3 °C per minute, 
without condensation occurring, until the lowest ambient temperature is reached, 
during which time an A-test shall be performed. 

D An A-test shall be performed with a duration of at least 2 h at the lowest am- 
bient temperature. At the end of that time, a B-test shall be carried out. 

g) The ambient temperature shall then be increased by not more than 0.3 ^C per 
minute to the value specified in 5.1.2,1, during which time an A-test shall be 
performed. 

h) An A-test shall be performed with a duration of at least 2 h at the temperature 
specified in 5.1.2»1. At the end of that time a B-test shall be carried out. 

5.4.3 Effects of electrical disturbances 

5.4.3.1 Supply voltage variations The external supply voltage and each inter- 
nally derived supply voltage shall in turn be varied in accordance with 4.3.2.1. During 
each test, C-tests shall be carried out as necessary to confirm that no failure to danger 
occurs at reduced voltage values. 

5-4-3.2 Supply voltage interruptions The tests specified in 4.3,2,2 shall be carried 
out with the duration of each test sufficiently long to cover at least 10 dips and to 
enable for each of tests 1) and 2) that a B-test shall be carried out, and for test 3) 
that a C-test shall be carried out. 

5,4,3,3 Fast transient/burst 

5.4.3.3.1 General requirements The ESPE shall be subjected to fast transient/ 
burst to the levels specified in 4.3.2.3.1 in accordance with JIS C 1000-4-4 (using 
figure 9 of JIS C 1000-4-4 for coupling of d.c. and less than 50 V a.c power and sig- 
nal ports, and figure 8 for other a.c. power ports). 

During each exposure a B-test shall be carried out. 

5.4.3.3.2 Additional tests A type 4 ESPE shall also be subjected to fast tran- 
sient/burst of the levels specified in 4.3.2.3.2 in accordance with JIS C 1000-4-4 
(using figure 9 of JIS C 1000-4-4 for coupling d.c. and less than 50 V a.c. power and 
signal ports, and figure 8 for other a.c. power ports). 

During each exposure a C-test shall be carried out. 
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5.4.3.4 Fast traesient/surge 

5.4.3.4.1 General requirements The ESPE shall be subjected to fast transient/ 
surge to the levels specified in 4.3.2.4,1 in accordance with JIS C 1000-4-5 (using 
figure 10 of JIS C 1000-4-5 for coupling of signal ports, figure 7 of JIS C 1000-4-5 
for coupling of less than 50 V a.c. and d.c. power ports, and figures 6 and 7 of JIS C 
1000-4-5 for other a.c. power ports). 

During each exposure a B-test shall be carried out. 

5.4.3.4.2 Additional tests The type 4 ESPE shall be subjected to fast transient/ 
surge to the levels specified in 4.3.2.4.2 in accordance with JIS C 1000-4-5 (using 
figure 10 of JIS C 1000-4-5 for coupling of signal ports, figure 7 of JIS C 1000-4-5 
for coupling of less than 50 V a.c. and d.c. power ports, and figures 6 and 7 of JIS C 
1000-4-5 for other a.c. power ports). 

During each exposure a C-test shall be carried out. 

5.4.3.5 Electromagnetic field 

5.4.3.5.1 General tests The ESPE shall be subjected to an electromagnetic field 
to the levels specified in 4.3.2.5 in accordance with JIS C 1000-4-3. During the 
exposure to severity level 3 a B-test shall be carried out. 

NOTE : The result of this test is dependent on the surrounding structures which 
may differ from when the ESPE is fitted to a machine. 

5.4.3.5.2 Additional tests A type 4 ESPE shall also be subjected to an electro- 
magnetic field to severity level X, During the exposure a C-test shall be carried out. 

NOTE : The result of this test is dependent on the surrounding structures which 
may differ from when the ESPE is fitted to a machine. 

5.4.3.6 Conducted disturbances induced by radiofrequency fields 

5.4.3.6.1 General tests The ESPE shall be subjected to conducted radiofrequency 
disturbances to the levels specified in 4.3.2.6.1 in accordance with JIS C 1000-4-6. 
During each exposure a B-test shall be carried out, 

5.4.3.6.2 Additional tests A type 4 ESPE shall also be subjected to conducted 
radiofrequency disturbances to the levels specified in 4.3.2.6.2 in accordance with 
JIS C 1000-4-6. During each exposure a C-test shall be carried out. 

5.4.3.7 Electrostatic discharge 

5.4.3.7.1 General tests The ESPE shall be subjected to electrostatic discharge 
to the levels specified in 4.3,2.7.1 in accordance with JIS C 1000-4-2, During each 
exposure a B-test shall be carried out. 

5.4.3.7.2 Additional tests A type 4 ESPE shall also be subjected to electrostatic 
discharge to the levels specified in 4.3.2.7.2 in accordance with JIS C 1000-4-2. During 
each exposure a C~test shall be carried out. 
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5.4.4 Mechanical influences 

5»4,4*1 Vibration The test sample shall be exposed to vibration tests according 
to JIS C 0040. 

The following conditions shall apply: 

Frequency range 10 Hz to 55 Hz. 

Sweep rate 1 octave/min. 

Amplitude 0.35 mm ±0.05 mm. The test shall be carried out with- 

out anti- vibration mountings. 

Number of sweeps 20 for each axis, for three axes (no delay by resonance fre- 
quencies). 

The following limited functional tests shall be performed for each axis: 

— an A-test shall be performed during each of the first and last sweeps; 

— a B-test shall be carried out, so that the test piece is brought into the detec- 
tion zone at the beginning of the second sweep and is removed at the end of 
the 19th sweep. 

5.4,4,2 Bump The test sample shall be exposed to bump tests according to JIS C 

0042. 

The following conditions shall apply: 

Acceleration 100 m/s^ 

Duration of pulse 16 ms 

Number of bumps 1 000 ± 10 for each axis, for three axes 
The following tests shall be performed for each axis: 

— an A-test shall be performed during each of the first and last (100 ± 10) bumps; 

— a B-test shall be carried out, so that the test piece is brought into the detec- 
tion zone after the first (100 ±10) bumps. 

5.4.5 Enclosures The requirements of 4.3.4 for degrees of protection shall be tested 
in accordance with JIS C 0920 after the tests of 5.4.4 have been completed. The 
remaining requirements shall be verified by inspection. 

5.5 Validation of programmable or complex integrated circuits 

5,5,1 General This subclause deals with the validation of the requirements of 4*2.10 
and 4*2«11, and any analysis statement included as part of the test results state- 
ment required by 5.3.1. 

Validation shall be undertaken by a competent person(s) who should be indepen- 
dent of those responsible for any aspect of the system design, the hardware design 
and the software design. A written validation report shall be compiled. 
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NOTE ; The validation provides independent confirmation that specific require- 
ments have been achieved. The process is intended to confirm that sys- 
tematic faults in the design have been avoided, that procedures are in place 
to maintain safety performance during the life cycle of the product (in- 
cluding, for example, following modification) and that the design of the 
ESPE fulfils the fault detection requirements appropriate to its type, 

5,5,2 Complex or prograiBmable integrated circuits For an ESPE employing 
a complex or programmable integrated circuit(s), the following requirements shall 
be validated by analysis: 

a) a minimum of two independent decision-making channels shall meet the require- 
ments of 4,2.10; 

b) the detection of disparity between channels, and the initiation of a lock-out con- 
dition, shall be maintained under all applicable fault conditions. 

5*5.3 Software, programming, functional design of integrated circuits It 
shall be verified that the specified procedures and supporting documentation for the 
quality system(s) under which the system design and software were developed meet 
the requirements of JIS Z 9901. 

The operation of the quality system(s) shall be verified by an audit inspection of 
the documentary records pertaining to the development of the equipment and the 
procedures established for the maintenance of quality during the life cycle of the 
product. 

The adequacy, completeness, and traceability of the project development docu- 
mentation shall be validated by audit inspection. 

The safety requirements specification shall be analysed to confirm that the re- 
quirements for software, program design, and functional design, not addressed therein 
have been addressed elsewhere in the system design. 

The test plan shall be analysed to confirm that all the requirements of the safety 
requirements specification can be verified by successful completion of the tests. 

When softw^are specific to fault detection is used in operation, the test plan shall 
be analysed to confirm that all faults considered in BAA which cannot be tested by 
direct hardware fault simulation are tested by the software. 

The test results of the latest issued version of the design shall be subjected to an 
audit inspection. Sample tests, chosen at random, shall be repeated for validation 
and the results shall agree in detail with those held in the project records. 

When software specific to fault detection is used in operation, the test results for 
simulated faults shall be inspected for adequate coverage and shall be compared with 
any analysis statement included as part of the test results statement. 

For software used in operation, it shall be verified that the entire operational 
instruction program is contained within read-only memory which cannot be over- 
written by the processor. 

For programmable devices, the means for verification that the device performs 
all its programmed functions shall be validated. 
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NOTE : Incorrectly or incompletely programmed devices may allow the equip- 
ment to perform the primary protective function correctly but fail to 
implement fault detection functions, particularly when multiple simi- 
lar programmable devices are used within a design which depends upon 
cross-monitoring for fault detection. 

The means employed to monitor program flow and/or the operation of complex/ 
programmable devices shall be validated. The means shall be appropriate for the 
level of safety-related performance claimed by the supplier, and the system archi- 
tecture employed (further guidance is under development), 

5*5,4 Test results analysis statement When analysis is employed to define the 
result of any test required by 5*3, the adequacy, suitability, and validity of the tech- 
niques used shall be validated. The correct implementation of the methods used 
shall be verified by repeating parts of the analysis selected at random. 

6 Marking for identification and for safe use 

6.1 General All parts of the ESPE shall bear all markings which are necessary: 

— for its unambiguous identification; 

— for its safe use, 

and supplementary information shall be given, as appropriate: 

— permanently on the ESPE; 

— in accompanying documents such as instruction handbooks; 

— on the packaging 

Signs or written warnings only sajdng "danger'* shall not be used. Markings, signs 
and written warnings shall be readily understandable and unambiguous, especially 
as regards the part of the function(s) of the machine which they are related to. Readily 
understandable signs (pictograms) should be used in preference to written warnings. 
Signs and pictograms should only be used if they are understood in the culture in 
which the machinery is to be used. Written warnings shall be drawn up in the 
language(s) of the country in which the machine will be used for the first time and, 
on request, in the language(s) understood by operators. Markings shall comply with 
recognized standards. 

See 17.1 of JIS B 9960-1 as regards marking of electrical equipment. 

The enclosure of the most appropriate part of the ESPE shall carry the following 
markings: 

a) identification of the product, including name and address of the supplier, des- 
ignation of series or type, serial number and year of construction; 

b) parameters, e.g. dimensions, of the detection zone; 

c) detection capability; 

d) response time; 

e) rated voltage(s) including number of phases and frequency where relevant; 
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f) rated input power (if greater than 25 W) or rated current; 

g) designation of IP code; 

h) for class II equipment (see JIS B 9960-1) only, symbol for classification for pro- 
tection against electric shock; 

i) warning sign of hazards arising from dangerous voltages; 

j) type of ESPE according to 4,1-3. 

6.2 ESPE supplied from a dedicated power supply Where an ESPE is de- 
signed to be supplied from an external dedicated power supply, details of the model 
or type of dedicated power supply with which it has been tested shall be perma- 
nently marked on the enclosure of the most appropriate part of the ESPE and in- 
cluded in the instructions for use. 

6*3 ESPE supplied from an internal electrical power source An ESPE sup- 
plied from an internal power source shall be marked with details of the rated cur- 
rent of the supply fuse, if applicable, on the enclosure of the most appropriate part 
of the ESPE. 

6.4 Adjustment When the ESPE can be adjusted to suit different rated voltages 
or different inputs, a marking showing the voltage or input to which the ESPE is 
adjusted shall be clearly and easily discernible at the point of adjustment. 

6.5 Enclosures Any enclosure which contains electrical devices shall be marked 
with a warning sign in accordance with 17,2 of JIS B 9960-1. 

6.6 Control devices 

6.6.1 Markings for switches, indicating lamps, and other control devices shall be 
placed adjacent to those components; they shall not be placed on removable parts 
which can be replaced in such a way that the marking is misleading. 

6.6.2 Functional identification of control and indicating devices shall be in accor- 
dance with 17.3 of JIS B 9960-1. 

6.6.3 The positions of any power supply switches shall be marked according to 5.3.3 
of JIS B 9960-1. 

6.6.4 Devices intended for the adjustment of a characteristic during or after instal- 
lation, shall be provided with markings of the direction of adjustment to increase or 
decrease the value of that characteristic. See also JIS C 0447. 

6.7 Terminal markings 

6.7.1 Terminals to which cable connections are to be made at the time of installa- 
tion, or reestablished after maintenance of the ESPE, shall be marked and related 
to a diagram. 
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6.7»2 Terminals for external connections provided with, and relating to the ESPE 
and user replaceable components shall be marked and related to a diagram. 

6.7.3 All terminals for the incoming supply connections shall be marked in accor- 
dance with JIS C 0445. 

6.7.4 Protective conductor connection points shall be marked in accordance with 
8*2.7 of JIS B 9960-1. This marking shall not be placed on screws, removable washers 
or other parts which might be removed when conductors are being connected/discon- 
nected. 

6.7*5 Where an ESPE is to be connected to more than two supply conductors it shall 
be provided with a connection diagram, fixed to the ESPE, unless the correct mode 
of connection is obvious. 

6,7,6 If more than one supply is taken to an ESPE, the marking shall include a 
warning that all supplies have to be switched off before the terminal cover may be 
removed. 

6,8 Marking durability Marking should be capable of withstanding the environ- 
mental influences of an industrial environment with respect to temperature and 
humidity as defined by this Standard, and liquids such as water, soapy water, ma- 
chine oil, benzene, etc. 

Markings shall be capable of withstanding being rubbed lightly for 15 s with a 
piece of cloth soaked with petroleum spirits, and with a piece of cloth soaked in water. 

7 Accompanying documents The supplier of the ESPE shall provide documen- 
tation in the languages agreed between the user and the supplier. 

The accompanying documents shall contain the information required for the in- 
stallation, use and subsequent disposal of the ESPE, including the following infor- 
mation w^here applicable: 

a) a statement that other devices shall not be connected to the internally gener- 
ated power supplies of the ESPE; 

b) details of the optional functions of the ESPE, described in annex A, which have 
been included and details of those optional functions that are available for fu- 
ture incorporation; 

c) a description of facilities for connection of stopping performance monitor if pro- 
vided; 

d) for a type 2 ESPE, information on the means of applying an external test sig- 
nal, where required (see 4.2,2); 

e) a recommendation that security keys/special tools, if provided for adjustments, 
operations or access, be kept under the control of a responsible or authorized 
person(s); 

f) the size and type of the test piece and the test procedure, or description of other 
methods for checking the detection capability and the operation of the visual 
indicator; 
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g) the response time; 

h) the rated operating conditions for the ESPE including: 

— temperature range, 

— humidity, 

— voltage range, 

— range of separation distances between the subsystems, and the maximum 
length of interconnecting cables. 

i) advice on the prevention of mutual interference of sensing functions; 

j) block diagrams, functional description chart showing sequence of relay switch- 
ing operations; 

k) the location of all input and output terminals; 

1) the ratings and characteristics of all input/output terminals; 

m) the maximum voltage and current that the output signal switching devices are 
capable of switching into an inductive load, and the maximum switching rate 
with this load; 

n) information to enable the user to carry out maintenance using the supplier's 
recommended spares; 

o) special requirements regarding input cables and terminations, if applicable; 

p) the total load/power requirements of the ESPE; 

q) details of the space required around the equipment for removal and mainte- 
nance purposes; 

r) a list of the user-replaceable parts specified by the supplier; 

s) a list of colour and coding systems (see JIS B 9960-1); 

t) the overall dimensions of the equipment; 

u) operating instructions; 

v) the location and dimensions of the detection zone(s) or definitions of other func- 
tional limits, including the defined signal range; 

w) a schedule of checks to be carried out after installation, after maintenance, or 
periodically, to establish that the device is functioning correctly; 

x) the method and frequency of regular testing to confirm that the level of safety 
integrity is maintained; 

y) a statement of the IP rating of the enclosures, or where the ESPE is intended 
to be mounted in a machine controlgear enclosure, the minimum IP rating re- 
quired of that enclosure according to 4.3.4; 

z) a clear statement of any particular application for which the ESPE is intended; 

aa) the maximum period between periodic tests for a type 2 ESPE; 
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bb) the installation and mounting instructions for any remote switches and controls; 

cc) instructions on where parts with restart interlock should be located in relation 
to the danger zone; 

dd) instructions on where parts with sensing functions should be located in rela- 
tion to the danger zone and methods for determination of safety distances be- 
tween those parts and the danger zones, for example formulae for calculation; 

ee) instructions on how the ESPE should be interfaced with the machine control 
system; 

ff) the details of any special precautions necessary to be taken into account; 

gg) the dimensions of the space(s) to be provided for the ESPE; 

hh) the dimensions and position of the means for supporting and fixing the ESPE 
within the space(s); 

ii) the minimum clearances between the various parts of the ESPE and the sur- 
rounding parts of the fitment; 

jj) the means of connection of the ESPE to the supply, and the interconnection of 
separate components, if any. 
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Annex A (normative) 
Optional functions of the ESPE 



A,l General An ESPE may include additional functions, or devices arranged to 
perform functions, within the safety-related control system. The selection and utili- 
zation of such devices or functions depends on the category of control and application. 

The ESPE together with the optional functions shall meet the requirements of 
this Standard. 

NOTE : In order to assist in the understanding of an ESPE, block schematic dia- 
grams are to be found in figures A.l and A.2. 

The following are optional devices or functions: 

— external device monitoring (see A.2); 

— stopping performance monitor (see A.3); 

— secondary switching device (see A.4); 

— start interlock (see A.5); 

— restart interlock (see A.6); 

— muting (see A.7); 

— ESPE used as a machine reinitiation device (see A.8). 

A,2 External device monitoring (EDM) 

A.2.1 Functional requirements EDM shall provide the necessary means for the 
connection of signals from external devices (e.g. MPCE(s), FSD(s), muting control 
device) such that the EDM can unambiguously monitor the state of those devices. 

The ESPE shall go to a lock-out condition when an incorrect state is detected in 
one of the devices being monitored by the EDM. 

A.2.2 Fault condition requirements The ESPE shall respond in accordance with 
4^2.2 to faults in the EDM. 

A.2*3 Verification it shall be verified by inspection and test that: 

— the necessary means are provided in the ESPE for the unambiguous monitor- 
ing of the devices for which the EDM is intended to be used; 

— the ESPE goes to the lock-out condition when any one of the devices being 
monitored is in an incorrect state; 

— the ESPE responds according to 4.2,2 to faults occurring in the EDM. 

A.2.4 Information for use The ESPE supplier shall provide information for the 
connection of the EDM to the appropriate devices. The supplier shall specify the 
type of any device for which the EDM is intended to be used. Where the monitored 
devices require particular characteristics (e.g. mechanically Hnked contacts, dupli- 
cate inputs, N/0, N/C) these shall be specified. 
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A.3 Stopping performance monitor (SPM) 

A.3.1 Functional requirements The SPM shall provide signals to the ESPE re- 
lated to the time taken by, or the amount of travel of, the hazardous parts of the 
machine in coming to rest or reverting to a safe condition. The ESPE shall go to a 
lock-out condition when a signal(s) from the SPM indicate(s) that the preset limit of 
stopping performance has been exceeded. 

For a type 4 ESPE, the SPM shall provide at least two signalling channels to the 
ESPE. Each channel shall be capable of initiating a lock-out condition of the ESPE. 

The SPM shall apply an automatic stopping performance test to monitor the overall 
system stopping performance. 

The SPM shall be capable of initiating the automatic stopping performance test 
in response to signals derived from the ESPE, immediately upon actual or simulated 
actuation of the sensing device. 

Any means by which the preset limit(s) within the SPM may be adjusted shall be 
in a lockable enclosure. 

A,3,2 Fault condition requirements The ESPE shall go to a lock-out condition 
in response to any of the following conditions: 

— upon failure to apply, or to complete the automatic test; 

— upon failure of transmission of motion to the stopping performance monitor 
or, when duplicated transmission means are used, upon failure of either one 
of those means; 

— upon disconnection of the stopping performance monitor from the ESPE. 

A.3*3 Verification Verify by inspection that: 

— the SPM output signal(s) causes the ESPE to go to a lock-out condition when 
the preset limit of stopping performance is exceeded; 

— for a type 4 ESPE application, there are at least two independent signal sources, 
from the SPM to the ESPE, and failure of either one of those causes lock-out; 

— the SPM initiates an automatic test in response to a signal from the ESPE; 

— the ESPE initiates an automatic SPM test upon actual or simulated actua- 
tion of the sensing function; 

— any adjustment means is in a lockable enclosure; 

— when the automatic test has failed to be applied or completed, a lock-out con- 
dition is achieved; 

— when any of the transmission of motion means has failed, a lock-out condi- 
tion is achieved; 

— when a SPM is disconnected from the ESPE, or from the safety-related con- 
trol system, a lock-out condition is achieved; 

— the markings conform to A.3.4 and are correct. 
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A.3.4 Marking The supplier shall provide permanently affixed markings to the 
SPM giving the following information: 

— name and address of the supplier; 

— the model type number and serial number; 

— the ESPE type number for which the SPM is designed; 

— the accuracy of the unit. 

A.4 Secondary switching device (SSD) 

A.4.1 Functional requirements When the ESPE power supply is switched off 
or when the ESPE is in a lock-out condition, the SSD shall be in the OFF-state. 

The ability of the SSD to perform its safety-related function shall be checked by 
an automatic start test, carried out when the ESPE power supply is switched on 
and before the OSSD(s) go to the ON-state, 

A.4.2 Fault condition requirements If the start test referred to in A.4.1 iden- 
tifies the inability of the SSD to go to the OFF-state, the OSSD(s) shall remain in 
the OFF-state. 

A.4*3 Verification Verify by inspection and test that; 

— when the SSD is in the ON-state and ESPE power supply is switched on, the 
OSSD(s) remain(s) in the OFF-state, even when a reset is attempted; 

— the SSD is in the OFF-state under lock-out conditions, 

A,5 Start interlock 

A.5.1 Functional requirements The start interlock shall prevent the OSSD(s) 
going to the ON-state when the electrical supply is switched on, or is interrupted 
and restored. 

The OFF-state of the OSSD(s) shall continue until the start interlock is reset to 
its ON-state, manually (e.g. by switch operation or by actuation and de-actuation of 
the sensing device). 

It shall not be possible for a start interlock to reset the OSSD(s) to the ON-state 
under a lock-out condition. 

A.5.2 Fault condition requirements A failure of the start interlock which causes 
it to go to, or remain in a permanent ON-state shall cause the ESPE to go to, or to 
remain in the lock-out condition. 

A,5-3 Verification Verify by inspection and test that: 

~ the OSSD(s) is(are) in the OFF-state when the start interlock is in the OFF- 
state; 

— when the power supply is switched on, the OSSD(s) remain(s) in the OFF- 
state until the start interlock is manually operated; 
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— during a lock-out condition, an attempt to reset the start interlock does not 
allow the OSSD(s) to go to the ON-state; 

— the lock-out condition is initiated if the start interlock fails. 

A,5,4 Indication A yellow indicator shall be provided which should illuminate when 
the OSSD(s) is(are) prevented from going to the ON-state by the start interlock. 

A*6 Restart interlock 

A,6,l Functional requirements The restart interlock shall prevent the OSSD(s) 
going to the ON-state when: 

— the detection zone is interrupted, or the defined signal range is exceeded, while 
the machine operation is at a hazardous part of its operating cycle; 

— the detection zone is interrupted, or the defined signal range is exceeded, while 
the machine is in automatic or semi-automatic mode; 

— there is a change of the machine operating mode or type of operation. 

The interlock condition shall continue until the restart interlock is manually reset. 
However, it shall not be possible to reset the restart interlock whilst the sensing 
device is actuated or the defined signal range is exceeded. 

A.6-2 Fault condition requirements A failure to meet the functional require- 
ments of A.6.1 shall cause the ESPE to go to the lock-out condition. 

A,6*3 Verification Verify by inspection and test that: 

— the OSSD(s) is in the OFF-state when the restart interlock is in the OFF- 
state; 

— the restart interlock will not reset to the ON-state while the sensing device 
is actuated; 

— the restart interlock goes to the OFF-state on sensing device actuation dur- 
ing a hazardous machine operation; 

— when the machine operating mode or type of operation is changed, the re- 
start interlock goes to the OFF-state; 

— the lock-out condition is initiated if the restart interlock fails; 

— resetting the restart interlock will not go to the ON-state whilst the sensing 
device is actuated or the defined signal range is exceeded. 

ASA Indication A yellow indicator shall be provided which should illuminate when 
the OSSD(s) is prevented from going to the ON-state by the restart interlock. 

A.7 Muting 

A*7.1 Functional requirements 

A.7.1.1 When the ESPE is in a muted condition, the OSSD(s) shall remain in the 
ON-state on actuation of the sensing device. 
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A,7.1-2 In a type 3 ESPE and in a type 4 ESPE there shall be facilities for con- 
necting two independent hard-wired muting signal sources. 

Should conflicting muting signals occur, the ESPE shall not allow a muted con- 
dition to occur. 

A,7.2 Fault condition requiremeiits 

A.7-2.1 In a type 2 ESPE, any fault in the muting input shall be revealed by the 
periodic test, and shall at least not allow a muted condition to occur. 

A,7.2*2 Any fault condition of the mute indicator(s) which results in a failure to 
conform to the requirements of A.7.4 shall not allow a muted condition to occur, 

A«7a3 Verification Verify by inspection and test that: 

— in a muted condition, the OSSD(s) remain(s) in the ON-state on actuation of 
the sensing device; 

— in a type 3 ESPE and in a type 4 ESPE there are two independent hard-wired 
muting signal sources and a muted condition is prevented whenever an in- 
valid combination of signals is present; 

— in a type 2 ESPE, any failure which could lead to a hazardous condition is 
revealed by the periodic test, and when such a failure is detected, a muted 
condition is prevented; 

— visual indicators are provided as required by A*7,4; 

— a failure of the indicators to comply with A,TA is revealed by the prevention 
of a muted condition. 

A.7.4 Indication One or more visual indicators shall be provided which shall il- 
luminate when the ESPE is in a muted condition in accordance with 4.2,3 of lEC 
61310-1. The illuminated area of each muted condition indicator shall be at least 
1 cm^ and shall have a brightness (luminance) of not less than 200 cd/m^, 

NOTE : The mute indicator(s) should be arranged to be readily visible from any 
normal position of the operator of the machine to which the ESPE is 
designated to be applied, and from the position at which any adjust- 
ment of the muting is normally carried out. 

A,8 ESPE used for reinitiation of machine operation 

A,8,l General If, in addition to its function as a protective device, the ESPE is to 
be used to initiate machine operation, the following modes of operation can be used: 

— single break, where an actuation and de-actuation of the sensing device ini- 
tiates machine movement; 

— double break, where two consecutive actuations and de-actuations of the sensing 
device initiate machine movement. 

Where this optional feature is provided as part of the ESPE, a start interlock as 
specified in A.5, and a restart interlock as specified in A.6, shall also be provided 
within the ESPE. 
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A.8.2 Functional requirements 

a) When the ESPE power is switched on or is interrupted and restored, it shall 
not be possible to use either of the modes of operation described in A*8*l before 
the start interlock has been reset. 

b) After actuation of the sensing device during hazardous motion, it shall not be 
possible to use either of the modes of operation described in A.8.1 before the 
restart interlock has been reset. 

c) Successive initiations of machine operation by the use of either of the modes of 
operation described in A.8.1 shall be possible only within a limited period of 
time. 

d) When double break initiation is selected, initiation by single break shall not be 
possible under any sequence of events or actions. 

e) If the limited period of time referred to in c) is exceeded, further machine ini- 
tiation shall not be possible until the restart interlock has been reset. 

f) Machine initiation by either of the modes of operation described in A*B.l shall 
not be possible following a change of initiation mode until the restart interlock 
has been reset. 

g) Facilities shall be provided to reset the timer controlling the limited period de- 
scribed in c) by external means, 

h) The adjustment means for the timer shall be within an enclosure with access 
requiring the use of tools. 

A*8*3 Fault condition requirements Any fault listed in annex B leading to a 
change in the machine initiation mode shall at least result in the operation of either 
the start interlock or the restart interlock. 

A.8.4 Verification Verify by inspection and test that: 

— after the ESPE power is switched on, or is interrupted and restored, it is not 
possible to use either of the modes of operation described in A*8*l until the 
start interlock has been reset; 

— after actuation of the sensing device during hazardous motion, it is not pos- 
sible to use either of the modes of operation described in A,8,l until the re- 
start interlock has been reset; 

— successive initiations of machine operation by the use of either of the modes of 
operation described in A*8.1 shall only be possible within a limited time period; 

— when double break initiation is selected, initiation by a single break shall not 
be possible under any sequence of events or actions; 

— machine initiation by either of the modes of operation described in A,8,l shall 
not be possible following a change of initiation mode until the restart inter- 
lock has been reset; 

— facilities are provided to reset the timer controlling the limited period described 
in c), by external means; 
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the adjustment means for the timer are within an enclosure with access re- 
quiring the use of tools; 

faults listed in annex B leading to a change in the machine initiation mode 
shall at least result in operation of either the start interlock or the restart 
interlock. 

NOTE : The time period permitted for successive initiations should not ex- 
ceed 30 s for machinery having a cycle time of less than 5 s. 
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Figure A.l Schematic example for the interfacing of a type 4 ESPE to a machine 
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Figure A.2 Schematic example for the interfacing of a type 2 ESPE to a machine 
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Annex B (normative) 

Catalogue of single faults affecting the electrical equipment of the ESPE, 

to be applied as specified in 5-3 



B.l Conductors and connectors 
B*l.l Conductors/cables 



Faults considered 


Exclusions 


Short circuit between any two conductors 


Conductors of a type 2 ESPE which are permanently 
connected (e.g. not using plug/socket combinations) 
and which are protected against external damage by, 
for example, cable ducting, armouring 


Conductors in separate multicore cables 


Open circuit of any conductor 


None 


Short circuit between any conductor and an 
exposed conductive part or the protective 
conductor 


None 


Short circuit between any conductor and a live 
part 


Conductors which are supported and/or terminated 
by multiconductor termination assemblies so as to 
prevent the fault occurring from, for example, 
mechanical failure near a termination point 



B.1.2 Printed circuits and printed circuit assemblies 



Faults considered 


Exclusions 


Short circuit between two adjacent conductors 


Where: 

— the base material is according to JIS* and the 
creepage distances and clearances are dimensioned 
to at least JIS C 8480, annex 2 with pollution 
degree 2 /installation category III; and 

— the assembled board is mounted in an enclosure 
giving a degree of protection to at least IP54 and the 
printed side(s) are coated with an ageing-resistant 
varnish or protective layer covering all conductor 
paths 


Open circuit of any conductor path 


None 



JIS*: See C 6482, C 6484, C 6485, C 6486, C 6488, C 6489, C 6490, C 6492, C 6493, C 6494. 
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B.1.3 Terminal blocks 



Faults considered 


Exclusions 


Short circuit between adjacent terminals 


Where the terminals used are in accordance with a 
relevant JIS Standard and the requirements of 
14.1,1 and 14.1.2 of JIS B 9960-1 are satisfied 


Open circuit of individual terminals 


None 



B.1.4 Multi-pin connectors (e.g. plug and socket for cable, relay, IC) 



Faults considered 


Exclusions 


Short circuit between any two adjacent pins 


Adjacent pins satisfying B.1.2 


Interchanged or incorrectly inserted connector 
when not prevented by mechanical means 


None 


Open circuit on individual connector pin 


None 



B.2 Switches 

B,2,l Electro-oieehanical position switches, manually operated switches and 
push-buttons (e.g. reset actuator, dip switch) 



Faults considered 


Exclusions 


Contact pairs will not close 


None 


Contact pairs will not open 


None 


Short circuit between adjacent contacts 
insulated from each other 


Only for type 2 ESPE where the switch used is in 
accordance with JIS C 8201 and conductive parts 
which become loose cannot bridge the insulation 
between contacts 


Simultaneous short circuit between three 
terminals of change-over contacts 


Only for type 2 ESPE where the switch used is in 
accordance with JIS C 8201 and conductive parts 
which become loose cannot bridge the insulation 
between contacts 


Note: See also note to B.2.2 
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B,2.2 Electro-mechanical devices (e.g. relay, contactor) 



Faults considered 


Exclusions 


Does not de-energize (all contacts remain in 
energized position e.g. due to mechanical fault) 


None 


Does not energize (all contacts remain in de- 
energized position e.g. due to mechanical fault, 
open circuit of coil) 


None 


Individual contact not opening 


None (see note) 


Individual contact not closing 


None (see note) 


Simultaneous short circuit between the three 
terminals of a change-over contact 


Only for type 2 ESPE where the creepage and 
clearance distances are dimensioned to at least JIS 
C 8480, annex 2 with pollution degree 2/installation 
category III and conductive parts which become loose 
cannot bridge the insulation between contacts 


Short circuit between contact circuits, and 
between contacts and coil terminals 


Only for type 2 ESPE where the creepage and 
clearance distances are dimensioned to at least JIS 
C 8480, annex 2 with pollution degree 2/installation 
category III and conductive parts which become loose 
cannot bridge the insulation between contacts and 
between contacts and the coil 


Note: When relays/contactors with mechanically-linked contacts are used, the non-opening of a contact 
can be detected by monitoring the position of another contact in the assembly. Requirements for 
these assemblies are under consideration. 



B»3 Discrete electrical components 
B.3.1 Transformers 



Faults considered 


Exclusions 


Open circuit of individual winding 


None 


Short circuit between windings 


Where the windings are separated according to JIS 
C9742 



B.3.2 Chokes 



Faults considered 


Exclusions 


Open circuit 


None 


Short circuit 


Where choke coil is single-layered, enamelled or 
potted, and with axial wire connections and axial 
mounting 


Changing value: 0.5 L^g < L < 2 Ln 

where Ln is the nominal value of inductance 


None 
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B.3.3 Resistors 



Faults considered 


Exclusions 


Open circuit 


None 


Short circuit 


Where the resistor is of the film type, or the wire- 
wound type with protection to prevent unwinding of 
the wire in the event of breakage, with axial wire 
connections, axial mounted and varnished 
No exclusion for resistors used in surface-mounting 
technology 


Changing value; 0.5 i^N < i? < 2 i?N 

where R^ is the nominal value of resistance 


None 



B.3.4 Resistor networks 



Faults considered 


Exclusions 


Open circuit of individual resistor 


None 


Short circuit between any two connections 


None 


Changing value of individual resistor: 

0.5Rii<R<2Rt; 

where i?N is the nominal value of resistance 


None 



B,3*5 Potentiometers 



Faults considered 


Exclusions 


Open circuit of each individual connection 


None 


Simultaneous short circuit between all 
connections 


None 


Changing value between any two connections: 

0.5 Rp<R < 2 Rv 

where i?p is the nominal value 


None 



B,3.6 Capacitors, fixed or adjustable 



Faults considered 


Exclusions 


Open circuit 


None 


Short circuit 


None, even with self-healing capacitors 


Changing value: 0.5 Cn < C < 2 Cn + tolerance 
where Cn is the nominal value or set value 


None 
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B.4 Solid-state electrical components 

B.4.1 Discrete semi-conductors [e.g. diode, transistor, triac, voltage regulator, 
phototransistor and light-emitting diode (LED)] 



Faults considered 


Exclusions 


Open circuit of any connection 


None 


Short circuit between any two connections 


None 


Short circuit between all connections 


None 


Changing electrical characteristics resulting in 
a safety-related output signal which is outside 
either the upper or lower limits of the defined 
signal range by 25 % of that range (see also 3.3) 


None 



B.4,2 Optocouplers 



Faults considered 


Exclusions 


Open circuit of individual connections 


None 


Short circuit between any two connections: 

— input connections (transmitter) 

— output connections (receiver) 

— between input and output 


None 

None 

Components having an impulse voltage withstand 

capability according to table 1 of JIS C 8480, 

annex 2, over-voltage category III 


Changing electrical characteristics resulting in 
a safety-related output signal which is outside 
either the upper or the lower limit of the 
defined signal range by 25 % of that range (see 
also 3.3) 


None 
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B.4.3 Integrated circuits, simple 



Faults considered 


Exclusions 


Open circuit for each individual connection 


None 


Short circuit between any two connections 


None 


Persistent "0" or "1" signal at all inputs and 
outputs, either individually or simultaneously 
(i.e. short-circuit to negative or positive rails 
with isolated input or disconnected output) 


None 


Parasitic oscillation of outputs 

NOTE: The choice of test frequency and the 

pulse duty factor is dependent on the switching 

technology and the external circuitry. When 

testing, the driving stages in question are 

disconnected 


Type 2 ESPE where analysis indicates that it is not 
safety-related 


Changing electrical characteristics resulting in 
a safety-related output signal which is outside 
either the upper or lower limit of the defined 
signal range by 25 % of that range (see also 3,3) 


None 



BAA Integrated circuits, complex or programmable 



Faults considered 


Exclusions 


Defect in part or all of the function (see also 
4.2,10 and 4.2.11). The defect may: 

— be static 

— change the logic 

— be dependent on bit sequences 


None 


Undetected failure in the hardware that goes 
unnoticed because of the complexity of 
integrated circuit (see also 4.2.10 and 4.2.11) 


None 


Defects in the storage and processing compo- 
nents not revealed by the complete execution of 
the program 


None 


All in B,4.3 


See B.4.3 



B.5 Motors 



Faults considered 


Exclusions 


Motor stopped 


None 


Speed above normal 


None 


Speed below normal 


None 
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JIS B 9704-1 : 2000 Safety of machinery — Electro- sensitive protective equipme?it — 
Part 1 : General requirements and tests 


lEC 61496-1 : 1997 Safety of machinery— Electro-sensitive protective 
equipment — I^art 1 : General requirements and 
tests 


(I) Requirements in MS 


(II) Inter- 
national 
Standard 
number 


(III) Requirements in 
International Standard 


(IV) Classification and details of 
technical deviation between JIS and 
the International Standard by clause 
Location of deviation: 
Indication method: 


(V) Justification for the 
technical deviation and 
future measures 


Clause 


Content 


Clause 


Content 


Classifi- 
cation by 
clause 


Detail of technical 
deviation 


1 Scope 


Specifications of general 
requirements for the 
design, construction and 
testing of electro-sensitive 
protective equipment 
(ESPE) for the safeguard- 
ing of machinery 


lEC 

61496-1 


Identical 
with JIS. 


Identical 
with JIS. 


IDT 






2 Normative 
references 


Normative references of 
JIS consist of 15 standards 
(translation) and JIS B 
9960-1 : 1999, and lEC, of 
lEC 60050 International 
Electrotechnical Vocabu- 
lary (lEV) and 2 informa- 
tive references. 


lEC 
61496-1 


Identical 
with JIS. 


Different 
from JIS. 


MOD/ 

addition 


Among the normative refer- 
ences, JIS C 9742 : 2000 is 
not based on any Interna- 
tional Standards. 


JIS C 9742 : 2000 specifies 
isolating transformers 
based on Electrical Appli- 
ance and Material Control 
Law. 


3 Definitions 


29 terms are defined. 


lEC 
61496-1 


Identical 
with JIS. 


Identical 
with JIS. 


IDT 


— 
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(I) Requirements in JIS 


(II) Inter- 
national 
Standard 
number 


(III) Requirements in 
International Standard 


(IV) Classification and details of 
technical deviation between JIS and 
the International Standard by clause 
Location of deviation: 
Indication method: 


(V) Justification for the 
technical deviation and 
future measures 


Clause 


Content 


Clause 


Content 


Classifi- 
cation by 
clause 


Detail of technical 
deviation 


4 Functional, 
design and 
environmental 
requirements 


Functional, design and 
environmental require- 
ments for ESPE are speci- 
fied. 


lEC 
61496-1 


Identical 
with JIS. 


Different 
from JIS. 


MOD/ 
addition 


Isolating transformers 
based on JIS C 9742 : 2000 
are specified in 4.2.1, Pro- 
vision in 4,2.3.1 admits 
components which conform 
to JIS but not to any Inter- 
national Standards. 


Molded case circuit break- 
ers and residual current 
operated circuit breakers 
specified in JIS C 8370 : 
1996 and JIS C 8371 : 1992, 
respectively are added to 
4.2.3.1. JIS intends to 
achieve future conformance 
to International Standards. 


5 Testing 


Conditions, measurement 
accuracy and documenta- 
tion of test results for tests 
such as type tests, func- 
tional tests, performance 
tests under fault condi- 
tions and environmental 
tests are specified. 


lEC 
61496-1 


Identical 
with JIS. 


Identical 
with JIS. 


IDT 






6 Mai-lting for 
identification 
and for safe 
use 


Information to be marked, 

location, type of marking 
are specified. 


lEC 
61496-1 


Identical 
with JIS. 


Identical 
with JIS. 


IDT 






7 Accompany- 
ing documents 


Specifications of documen- 
tation provided by the sup- 
plier of the ESPE, which 
contains information re- 
quired for the installation, 
use and subsequent dis- 
posal of the ESPE 


lEC 
61496-1 


Identical 
with JIS. 


identical 
with JIS. 


IDT 
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Location of deviation: 
Indication method: 


(V) Justification for the 
technical deviation and 
future measures 


Clause 


Content 


Clause 


Content 


Classifi- 
cation by 
clause 


Detail of technical 
deviation 


Annex A 
(normative) 


Specifications of the re- 
quirements of optional 
functions of the ESPE 


lEC 
61496-1 


Identical 
with JIS. 


Identical 
with JIS, 


IDT 


— 




Annex B 

(normative) 


Specifications of single 
faults affecting the elec- 
trical equipment of the 
ESPE 


lEC 
61496-1 


Identical 

with JIS. 


Identical 
with JIS. 


IDT 







Designated degree of correspondence between JIS and International Standard: MOD 



Remarks 1 Symbols in sub-columns of (IV) in the above table indicate as follows; 
"IDT" and "— ": Identical in technical contents. 
"MOD/addition": Adds specification item(s) or content(s) not included in International Standard. 
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